hosts/courge/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy2.nix
   5     ../../nixos/profiles/wireguard/wg-intra.nix
   6     ../../nixos/profiles/networking/ssh.nix
   7     ../../nixos/profiles/networking/wifi.nix
   8     ./wireguard.nix
   9     networking/nftables.nix
  10   ];
  11   install.substituteOnDestination = false;
  12   #networking.domain = "wg";
  13   networking.useDHCP = false;
  14
  15   networking.nftables.ruleset = lib.mkAfter ''
  16     table inet filter {
  17       chain input {
  18         ip daddr 10.0.0.0/8 counter goto input-lan
  19         ip daddr 172.16.0.0/12 counter goto input-lan
  20         ip daddr 192.168.0.0/16 counter goto input-lan
  21         ip daddr 224.0.0.0/3 counter goto input-lan
  22         goto input-net
  23       }
  24       chain output {
  25         ip daddr 10.0.0.0/8 counter goto output-lan
  26         ip daddr 172.16.0.0/12 counter goto output-lan
  27         ip daddr 192.168.0.0/16 counter goto output-lan
  28         ip daddr 224.0.0.0/3 counter goto output-lan
  29         jump output-net
  30         log level warn prefix "output-net: " counter drop
  31       }
  32     }
  33   '';
  34
  35   networking.interfaces = { };
  36
  37   networking.networkmanager = {
  38     enable = true;
  39     unmanaged = [
  40     ];
  41   };
  42
  43   services.avahi.enable = true;
  44   services.avahi.openFirewall = false;
  45   services.avahi.publish.enable = false;
  46
  47   services.openssh.settings.X11Forwarding = true;
  48   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  49     "host.key:${ssh/host.key.cred}"
  50   ];
  51
  52   services.vnstat.enable = true;
  53 }